SAP BTP - Trust and authorization Identity Provider monitor

Original query, unchanged.

SAPBTPAuditLog_CL
| where isnotnull(Message.object)
| extend Object = Message.object, Attributes = Message.attributes
| where Object.type == "IdentityProvider"
| extend CrudType = tostring(parse_json(tostring(Object.id)).crudType)
| mv-expand Attributes
| extend MessageText = case(
                           CrudType == "CREATE",
                           "An identity provider was created",
                           CrudType == "UPDATE",
                           "An identity provider was updated",
                           CrudType == "DELETE",
                           "An identity provider was deleted",
                           "Unclassified CRUD operation encountered"
                       )
| extend NewAttributes = parse_json(replace_regex(tostring(Attributes.new), "\\r", ""))
| extend OldAttributes = parse_json(replace_regex(tostring(Attributes.old), "\\r", ""))
| extend IdentityProviderName = case(
                                    CrudType == "CREATE" or CrudType == "UPDATE",
                                    NewAttributes.name,
                                    CrudType == "DELETE",
                                    OldAttributes.name,
                                    "Unknown"
                                )
| project
    UpdatedOn,
    UserName,
    MessageText,
    IdentityProviderName,
    Tenant,
    SpaceId,
    CloudApp = "SAP BTP"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]